Exchange 2003 tons of queued messages

reliantcorp
reliantcorp used Ask the Experts™
on

We had a problem last week which was an ISP problem in the end. While troubleshooting we opened the server for relay and gave access permissions to any IP address.

After the problem was fixed we all setting were put back as they were before the problem.
SMTP virtual server connection control has only postini listed (we use postini).

No relay permissions, clients only use exchange from the internal netwrok through outlook or owa.

Today I've realized the queue was filled with thousands of messages and lots of connections for many different domains.

Anonymous access is checked under access control, but as far as I know that doesnt mean the server will be an open relay but will only accet email with local mailboxes as it's destination.

I tried deleting the messages but they tyhey keep filling the queue.

I can't tell where are coming from when opening the messages from the queue. Just the "spoofed" sender but no IP address.


I will really appreciate any help.

Thanks
Diego
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Did you restart the SMTP service after making the changes to permissions.  If not - you are still an open relay.

Test on www.checkor.com

If you are still an open relay, you will no doubt have popped up on a blacklist or two so please check on www.mxtoolbox.com/blacklists.aspx

Commented:
You can delete the messages from the queue directory on the server (not in the Exchange System Manager), I forget exactly where (and it depends on which drive you installed Exchagne on), but there is a folder called Queue (I think that's it).

I would stop the SMTP services completely, clear out the queued up spam, verify that your set not to be an open relay (you need anonymous authentication for inbound connections as people connecting to you to send email to you are anonymous, no other way for them to authenticate), and only then restart the SMTP service.  You might want to enable SMTP logging on the SMTP virtual server while your at it for troubleshooting...

Author

Commented:

I'm getting connection refused from several open relay tools adn the address is not listed on any blacklist.

Might be coming from an infected computer ? it's just to many messages.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Alan HardistyCo-Owner
Top Expert 2011

Commented:
Okay - who is the sender of the spam in your queues?

Postmaster or random external domain name users?

Author

Commented:

Random senders from lots of different domains.

I've now enabled connection filtering and sender filtering but the queue keeps filling up. And growing.

I don't get it.

Help !!!!

Author

Commented:


Even with smtp stopped queue keeps growing.... ?!?!

Author

Commented:

Forget last post, smtp was running
Co-Owner
Top Expert 2011
Commented:
Alan HardistyCo-Owner
Top Expert 2011
Commented:
Queues will keep growing as your server can't keep up with what it has been sent, so it didn't have everything in the queue when you stopped SMTP and it was playing catch-up.

Quick fix - disable Integrated Windows & Basic Auth on the SMTP Virtual Server then restart the SMTP service.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial